node.js - "PERMISSION_DENIED: Missing or insufficient permissions"当使用 google 云任务调用 firestore 函数时

Question

我创建了一个函数，用于向 Firestore 数据库添加一个条目。

const functions = require("firebase-functions");

const admin = require('firebase-admin');
admin.initializeApp();

exports.addMessage = functions.https.onRequest(async (req, res) => {
    const original = 'dhara';
    const writeResult = await admin.firestore().collection('messages').add({original: original});
    res.json({result: `Message with ID: ${writeResult.id} added.`});
});

通过以下命令创建队列

gcloud tasks queues create auction-autobid-queue

然后创建 Google Cloud Task。

const serviceAccount = require('./my-service-account.json');

const {CloudTasksClient} = require('@google-cloud/tasks');

const client = new CloudTasksClient({
  credentials: serviceAccount
});

async function createTask() {
     const project = 'my-project';
     const queue = 'auction-autobid-queue';
     const location = 'europe-west1';
     const payload = 'Hello, World!';
     const serviceAccountEmail = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="75180c581b14181035180c5805071a1f1016015b1c14185b12061007031c16101416161a001b015b161a18" rel="noreferrer noopener nofollow">[email protected]</a>";
      const parent = client.queuePath(project, location, queue);
  
    const task = {
      httpRequest: {
        httpMethod: 'GET',
        url: 'https://us-central1-my-project.cloudfunctions.net/addMessage',
        oidcToken: {
          serviceAccountEmail,
        },
      },
    };
  
    const inSeconds = 60;
    if (inSeconds) {
     task.scheduleTime = {
        seconds: inSeconds + Date.now() / 1000
      };
    }
  
    console.log('Sending task:');
    console.log(task);
    const request = {parent, task};
    const [response] = await client.createTask(request);
    const name = response.name;
    console.log(`Created task ${name}`);
  }

  process.on('unhandledRejection', err => {
    console.error(err.message);
    process.exitCode = 1;
  });

  createTask();

我已将此任务添加到队列中。现在，当我从 Google Cloud Console 运行此任务时，它会抛出错误。我检查了 firebase 函数日志，我可以看到调用的函数，但它抛出了我

Error: 7 PERMISSION_DENIED: Missing or insufficient permissions.

我有一个服务帐户 云函数开发人员 云函数服务代理 所有者角色。

我不明白这里有什么问题，因为分配的角色非常好。

Answer 1

您的 Firestore 数据库可能无法正确链接，因为您没有使用 serviceAccountKey 对其进行初始化。

在以下位置查找您的 serviceAccountKey:Firebase 仪表板 -> 项目设置 -> 服务帐户选项卡

下载该 json 文件，重命名并将其复制到源文件夹，在我的例子中，我将其重命名为“myServiceKey.json”

const admin = require("firebase-admin");
const serviceAccount = require("./myServiceKey.json");

const firebase = admin.initializeApp({
   credential: admin.credential.cert(serviceAccount)
});
const firestore = firebase.firestore();

exports.addMessage = functions.https.onRequest(async (req, res) => {
    const original = 'dhara';
    const writeResult = await firestore().collection('messages').add({original: original});
    res.json({result: `Message with ID: ${writeResult.id} added.`});
});